Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (338487 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-51813 1 Free And Open Source Inventory Management System Project 1 Free And Open Source Inventory Management System 2025-06-20 6.5 Medium
Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute arbitrary code via the staff_list parameter in the index.php component.
CVE-2023-48132 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-48129 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-47355 1 Eyuepcanyilmaz 1 Root Quick Reboot 2025-06-20 7.5 High
The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for PowerOff, Reboot, and Recovery (e.g., com.eypcnnapps.quickreboot.widget.PowerOff) that are susceptible to unauthorized broadcasts because of missing input validation.
CVE-2023-43997 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-43996 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-43995 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-43992 1 Linecorp 1 Line 2025-06-20 5.4 Medium
An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-43317 1 Coign 1 Coign 2025-06-20 8.8 High
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storage component.
CVE-2023-38319 1 Opennds 1 Opennds 2025-06-20 9.8 Critical
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVE-2023-38318 1 Opennds 1 Opennds 2025-06-20 9.8 Critical
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVE-2023-37571 1 Softing 1 Th Scope 2025-06-20 6.1 Medium
Softing TH SCOPE through 3.70 allows XSS.
CVE-2023-33758 1 Splicecom 1 Maximiser Soft Pbx 2025-06-20 6.1 Medium
Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in the login component.
CVE-2023-33757 1 Splicecom 2 Ipcs, Ipcs2 2025-06-20 5.9 Medium
A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and before allows attackers to eavesdrop on communications via a man-in-the-middle attack.
CVE-2023-31505 1 Schlix 1 Cms 2025-06-20 7.2 High
An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file.
CVE-2023-29055 1 Apache 1 Kylin 2025-06-20 7.5 High
In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials. When the kylin service runs over HTTP (or other plain text protocol), it is possible for network sniffers to hijack the HTTP payload and get access to the content of kylin.properties and potentially the containing credentials. To avoid this threat, users are recommended to  * Always turn on HTTPS so that network payload is encrypted. * Avoid putting credentials in kylin.properties, or at least not in plain text. * Use network firewalls to protect the serverside such that it is not accessible to external attackers. * Upgrade to version Apache Kylin 4.0.4, which filters out the sensitive content that goes to the Server Config web interface.
CVE-2022-4964 1 Canonical 1 Ubuntu Pipewire-pulse 2025-06-20 5.5 Medium
Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.
CVE-2021-42146 1 Contiki-ng 1 Tinydtls 2025-06-20 7.5 High
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers allow remote attackers to reuse the same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability allows remote attackers to obtain sensitive application (data of connected clients).
CVE-2021-42145 1 Contiki-ng 1 Tinydtls 2025-06-20 7.5 High
An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to cause a denial of service.
CVE-2021-42144 1 Contiki-ng 1 Contiki-ng Tinydtls 2025-06-20 7.5 High
Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafted input to dtls_ccm_decrypt_message().